GMP governance and board oversight
A board does not run a quality system. It does need assurance that one exists, works, and is resourced — and the reporting most boards receive is not designed to provide that. This is short by intention: what to ask, and what an adequate answer looks like.
Enterprise GMP risk, the assurance a board should expect, and the questions that surface exposure while it is still cheap.
GMP compliance is a condition of the licence to operate. That places it firmly inside enterprise risk rather than inside operational detail, and it means the board has a legitimate interest in evidence rather than in reassurance.
The reporting problem is structural. Quality metrics are usually presented as activity — how many deviations, how many audits — rather than as position. Volume tells a board almost nothing. Ageing, recurrence, closure quality and the gap between plan and execution tell it a great deal.
The governance failure to watch for is a management review that produces minutes rather than decisions. Where known gaps are recorded repeatedly without being resourced, the organisation has documented its own awareness without acting on it — which is materially worse than not having recorded it.
- Assurance, not reassurance
- Evidence that the quality system is effective, including independent verification, rather than management's confidence that it is.
- Resourcing decisions
- Whether the quality function is funded to prevent rather than only to process is a governance question.
- Enterprise risk registration
- Licence, supply and reputational exposure arising from GMP belongs on the risk register with a named owner.
- Culture oversight
- Whether problems can be raised safely determines whether the board hears about them at all.
What to watch, in your own reporting
Reporting by volume rather than by ageing
Counts without trend or age tell the board nothing about position.
Known gaps recorded repeatedly, never resourced
Documented awareness without action is a harder position to defend than no record at all.
No independent verification
Assurance sourced entirely from the function being assured is not assurance.
Quality escalations arriving only as crises
If the board only hears about quality when something has failed, the early signals are not reaching it.
Six questions that surface exposure early
- 01What is our current inspection position, and when was it last independently verified?
- 02Are commitments from the last inspection closed, with evidence, or closed on paper?
- 03What is the trend in overdue corrective actions and investigation ageing — not the volume, the trend?
- 04What did management review decide, and what did it decline to fund?
- 05Where is quality capability concentrated in one individual?
- 06What would an unannounced inspection find this week?
Move from reading to a position
The same risk, different chair
Establish the position before deciding the response
The readiness score covers seven quality-system domains in twenty questions and names the two areas carrying most of your exposure. It calculates in your browser and submits nothing.